Base64 Explained: What It Is, Why It Exists, and When You'd Actually Use It

If you've spent any time looking at web tokens, email headers, or embedded images in CSS, you've probably run into strings that look something like this:

SGVsbG8sIHdvcmxkIQ==

That's "Hello, world!" encoded in Base64. It looks like random gibberish, but there's a perfectly logical system behind it — and once you understand it, a lot of mysterious-looking things start to make sense.

What Is Base64?

Base64 is a way of representing binary data using only printable text characters. The name comes from the number of characters in its alphabet: 64. Those characters are A–Z (26), a–z (26), 0–9 (10), plus + and / — and the = sign for padding at the end.

The core idea: take any sequence of bytes — an image, a file, a piece of binary data — and convert it into a string that contains nothing but safe, printable characters. No control characters, no special characters that get misinterpreted, no characters that can't travel safely through text-only systems.

Why Was It Invented?

Base64 was created to solve a specific historical problem: email.

Early email systems were designed for plain ASCII text only — 7-bit characters, nothing fancy. When people started wanting to send binary files (images, documents, audio) through email, there was no standard way to do it. MIME (Multipurpose Internet Mail Extensions) was created in the early 1990s to add this capability, and Base64 became the standard encoding for non-text attachments.

That's why, if you've ever opened a raw .eml file, you see long blocks of seemingly random text — that's your image or PDF, Base64-encoded.

How Does It Work?

Base64 takes binary data in groups of 3 bytes (24 bits) and splits each group into four 6-bit chunks. Each 6-bit chunk (which can represent a number from 0 to 63) maps to one of the 64 characters in the Base64 alphabet. So every 3 bytes of input become 4 characters of output.

This means Base64-encoded data is about 33% larger than the original. It's a deliberate trade-off: you gain universal text compatibility, but you pay with file size.

Where You'll See Base64 Today

• Data URLs: Images embedded directly in HTML or CSS look like src="data:image/png;base64,iVBORw0KGg..." — small icons are often inlined this way to save HTTP requests
• JWT tokens: JSON Web Tokens use Base64URL (a variant using - and _) to encode the header and payload. The part before the first dot in a JWT is Base64-encoded JSON
• Email attachments: Still used exactly as originally intended
• HTTP Basic Auth: The Authorization header sends credentials as username:password encoded in Base64
• Web fonts in CSS: Fonts are sometimes embedded as Base64 data in stylesheets

Base64 Is Not Encryption — This Is Important

This is the most critical thing to understand: Base64 provides zero security. Anyone who sees a Base64 string can decode it instantly with any tool or a single line of code in any language. There is no key, no secret, no protection.

Encoding transforms data into a different representation for compatibility purposes. Encryption scrambles data in a way that requires a secret key to unscramble. They are completely different things with completely different purposes. Never use Base64 to "hide" sensitive information.

The HTTP Basic Auth example above is a good illustration: the browser encodes your credentials in Base64 not to hide them, but because the HTTP spec requires the Authorization header to be a text string. If you're not using HTTPS, those credentials are plainly readable to anyone watching the traffic.

Try It Yourself

Our Base64 Encoder and Decoder tools let you encode or decode any text instantly in your browser. Paste a Base64 string to decode it, or type any text to see what it looks like encoded. It's a handy reference when you're working with APIs, tokens, or data URLs.